Hello everyone and welcome to this lesson.
As we are understanding about nuclei fuzzing in
this lesson. We are going to see the second technique which
is pitch fork.
So what is Pitchfork exactly? It means
that it rates all the payloads simultaneously
that means
username first payload from username.txt for
the password field password from
the password dot txt file. So
one by one simultaneously it
will keep on iterating all the payloads.
So it is the Practical time and let's quickly see
how we can perform fuzzing using pitchfork.
So I have written a template over here, which is
fuzzing Pitchfork. This is the info block. Let's
quickly jump on the request block.
So this is a HTTP raw request a post
request that can be seen over here, which is going to
the same endpoint. Nothing has been changed over here.
What has been changed is the attack type? We
have changed the attack type from cluster
bomb to Pitchfork and we
keep the same matching condition as success as
a word in the body and status
code AS 200.
Let's go to terminal and let's run
the same scan.
With the new custom template that
we have written right now, which is pitchfork.
And let's add hyphen V
to this and hit enter.
Now you can see the new word list that
we created has been loaded. The username is demo.
The password is demo username Tomcat password
Tomcat username actify password hacktify
so we can see over here one by
one. Each username has been taken from the username.txt. Each
password has been taken from the password Dot txt.
And the iteration keeps on going simultaneously.
Until it identifies the correct username
and password as can be seen over here.
So we can see over here. The parameter B is
admin which is the password and parameter a
is admin, which is the username which is been successfully found.
Let's run this once more without supplying hyphen
V and let's wait for the output to complete.
Now it would quickly identify the
correct username and password while fussing and give
us the result in this format.
If you want to see what exactly is happening behind
the hood or you want to capture the request in
burpsuit as well. You can also do that. So
I'm going to specify the proxy quickly.
All the requests should pass through my book
proxy, which is running on 8081.
Now remember each request that would be passed would
be a username password combination
simultaneously. Let's hit enter
and let's go over here.
And you can see continuously request has been sent over here.
Let us pick one of the request and we can see username
past as hacking password past as
hacking, which is incorrect username and password, hence.
We would get a field message.
The correct username is admin and the correct username is
password which might have been passed in one of the requests
from here.
So, let's see that as well. You can see in this request admin
and admin has been passed and the
result is success.
So this way you can also write a fuzzing
template based on the attack that we have
used right now, which is Pitchfork. I hope
you understood. Thank you.